initial CCF commit by nadavgru · Pull Request #13449 · Azure/Azure-Sentinel

nadavgru · 2026-01-15T11:33:01Z

Change(s):

Initial Filewall Data Connector

Reason for Change(s):

Initial Filewall Data Connector

Version Updated:

Initial version
Including initial Workbook, Parsers, Data connector and Analytics Rules.

Testing Completed:

Yes

Checked that the validations are passing and have addressed any issues that are present:

Yes

nadavgru · 2026-01-15T11:40:00Z

@microsoft-github-policy-service agree [company="odix"]
@microsoft-github-policy-service agree
@microsoft-github-policy-service agree company="Microsoft"

nadavgru · 2026-01-15T11:41:37Z

@microsoft-github-policy-service agree company="odix"

v-maheshbh · 2026-01-19T06:40:43Z

Hi @nadavgru
BasePath Format:
Modify the BasePath to the following structure:
C:\GitHub\Azure-Sentinel\solutions\Solution Name

Kindly add the release notes with proper comments. Please include the workbook preview images inside the solution folder as well as in the following path:
https://github.com/Azure/Azure-Sentinel/tree/master/Workbooks/Images/Preview.
Additionally, update the workbook metadata file and refer to any existing solution for guidance.

For the CCF connector, kindly refer to the solution provided below and attach the Testing screenshot of the connector in a connected state.
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/Data%20Connectors

Thanks!

…wall # Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json # Workbooks/WorkbooksMetadata.json

nadavgru · 2026-01-19T16:00:32Z

Connected State:

Rename preview images. remove 01 number in end of pngs fix missing dependency in dataTypesDependencies woorkbook metadata Fix provider name of workbook metadata

v-maheshbh · 2026-01-23T08:21:05Z

Hi @nadavgru
The relevantTechniques field is missing in the analytic rule. Kindly update the rule to include the appropriate relevant techniques and update your branch from master to resolve the workbook validation issues.
Kindly add the release notes with version, date and descriptive details for this update.

For the CCF connector, kindly refer to the solution provided below.
https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cloudflare%20CCF/Data%20Connectors

Thanks!

v-maheshbh · 2026-01-27T11:29:37Z

Hi @nadavgru
Please resolve the conflicts in this branch.

Thanks!

# Conflicts: # Workbooks/WorkbooksMetadata.json

v-maheshbh · 2026-03-06T08:52:06Z

Hi @nadavgru

Kindly review the above comments and resolve the branch conflict.

Thanks!

# Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

v-maheshbh · 2026-03-27T05:49:09Z

Hi @nadavgru

Kindly resolve the branch conflict to proceed further.

Thanks!

v-maheshbh · 2026-04-06T08:02:34Z

Hi @nadavgru
Kindly attach the testing screenshots for the Analytical Rule, Workbook, Parser invocation logs, and the CCF Connector in a Connected state for validation.

Thanks!

nadavgru · 2026-04-06T09:25:41Z

Hi, Thank you so much for catching up. I'm currently on vacation and the project will continue only next month. Thanks you, Nadav Get Outlook for Android From: v-maheshbh ***@***.***> Sent: Monday, April 6, 2026 3:03:02 PM To: Azure/Azure-Sentinel ***@***.***> Cc: Nadav Gruber ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/Azure-Sentinel] initial CCF commit (PR #13449) v-maheshbh left a comment (Azure/Azure-Sentinel#13449) Hi @nadavgru Kindly attach the testing screenshots for the Analytical Rule, Workbook, Parser invocation logs, and the CCF Connector in a Connected state for validation. Thanks! — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.Message ID: ***@***.***>

v-maheshbh · 2026-04-16T06:09:37Z

Hi @nadavgru

Kindly resolve the branch conflict to proceed further.

Thanks!

# Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

v-maheshbh · 2026-05-20T09:06:03Z

HI @nadavgru

Kindly attach the testing screenshots for the Analytical Rule, Workbook, Parser invocation logs, and the CCF Connector in a Connected state for validation.
Thanks!

nadavgru · 2026-05-26T09:17:29Z

Hi @v-maheshbh , here are to final required screenshot.
thank you

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds the initial Filewall for Microsoft 365 Microsoft Sentinel solution content, including a Codeless (CCF/CLv2) REST API polling connector, parsers, analytics rules, and a workbook.

Changes:

Added a new Filewall solution package (connector definition + DCR + tables + polling config, UI definition, solution data/metadata, release notes).
Added Filewall parsers and two scheduled analytic rules.
Added workbook content (and workbook gallery metadata), plus KQL validation artifacts for custom tables/functions.

Reviewed changes

Copilot reviewed 21 out of 30 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
Workbooks/WorkbooksMetadata.json	Registers a new Filewall workbook entry in the global workbook gallery metadata.
Workbooks/FilewallM365Overview.json	Adds a workbook template at the repo root for Filewall M365 overview.
Solutions/Filewall for Microsoft 365/Workbooks/FilewallM365Overview.json	Adds the solution-scoped copy of the Filewall M365 overview workbook.
Solutions/Filewall for Microsoft 365/SolutionMetadata.json	Introduces solution marketplace metadata (publisher/offer/support/categories).
Solutions/Filewall for Microsoft 365/ReleaseNotes.md	Adds initial release notes for the solution version.
Solutions/Filewall for Microsoft 365/Parsers/FilewallM365FileEvent.yaml	Adds Filewall file-event parser function.
Solutions/Filewall for Microsoft 365/Parsers/FilewallM365ExchangeEvent.yaml	Adds Filewall Exchange-event parser function.
Solutions/Filewall for Microsoft 365/Package/testParameters.json	Adds package test parameters for ARM/validation.
Solutions/Filewall for Microsoft 365/Package/createUiDefinition.json	Adds solution installation UI definition (portal experience).
Solutions/Filewall for Microsoft 365/Data/Solution_FilewallM365.json	Defines solution packaging manifest (connectors/workbooks/parsers/rules).
Solutions/Filewall for Microsoft 365/Data Connectors/FilewallM365Logs_CCP/FilewallM365_Table.json	Defines custom tables for Filewall Exchange/File logs.
Solutions/Filewall for Microsoft 365/Data Connectors/FilewallM365Logs_CCP/FilewallM365_PollingConfig.json	Defines 4 RestApiPoller connections (Exchange/SharePoint/OneDrive/Teams).
Solutions/Filewall for Microsoft 365/Data Connectors/FilewallM365Logs_CCP/FilewallM365_DCR.json	Defines DCR streams and transformations for custom tables.
Solutions/Filewall for Microsoft 365/Data Connectors/FilewallM365Logs_CCP/FilewallM365_ConnectorDefinition.json	Adds the connector UI definition, sample queries, and instructions.
Solutions/Filewall for Microsoft 365/Analytic Rules/BlockedFiles.yaml	Adds scheduled rule for blocked files based on the parser.
Solutions/Filewall for Microsoft 365/Analytic Rules/BlockedEmails.yaml	Adds scheduled rule for blocked emails based on the parser.
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json	Registers the new connectorId for detection schema validation.
.script/tests/KqlvalidationsTests/CustomTables/FilewallFile_CL.json	Adds custom table schema for KQL validation.
.script/tests/KqlvalidationsTests/CustomTables/FilewallExchange_CL.json	Adds custom table schema for KQL validation.
.script/tests/KqlvalidationsTests/CustomFunctions/FilewallM365FileEvent.json	Adds function signature for KQL validation of the file parser.
.script/tests/KqlvalidationsTests/CustomFunctions/FilewallM365ExchangeEvent.json	Adds function signature for KQL validation of the Exchange parser.

v-maheshbh · 2026-05-28T10:54:05Z

Hi @nadavgru

Kindly review the above comments and address them as applicable. and update branch from master.

Thanks!

nadavgr · 2026-05-28T20:01:28Z

tmp_a0fd08e3-f92d-411e-bfee-fcbc53448455

Hi @v-maheshbh, All fixed.
There was a comment on the publisher id.
I set it as "odix" as attached screenshot.
Is the correct?

Thanks

v-maheshbh · 2026-05-29T05:25:54Z

Hi @nadavgru

Kindly review and address the failed validations.
Thanks!

nadavgru · 2026-05-30T11:42:15Z

@v-maheshbh fixed validation issue.

initial CCF commit

8d05ef2

nadavgru requested review from a team as code owners January 15, 2026 11:33

fix Logo Validation

7c117a9

v-atulyadav assigned v-maheshbh Jan 15, 2026

v-atulyadav added Codeless Connector Framework (CCF) Connector New Solution For new Solutions which are new to Microsoft Sentinel labels Jan 15, 2026

Fix: Add connector id

7177a37

nadavgru and others added 4 commits January 19, 2026 13:19

Merge branch 'Azure:master' into filewall

51b4dd4

update workbook

15139e8

update package

ba07291

Merge branch 'filewall' of github.com:odixer/Azure-Sentinel into file…

a0c54c0

…wall # Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json # Workbooks/WorkbooksMetadata.json

nadavgru requested a review from a team as a code owner January 19, 2026 14:02

nadavgr and others added 7 commits January 20, 2026 09:17

add missing preview woorkbook files

a22da39

update logo svg. remove style=

b50d7b2

remove empty entityMapping from analytics rules

1e3491a

Merge branch 'Azure:master' into filewall

6550921

Add release notes

57ff2e1

Fix missing relevantTechniques in analytics rules

66e46e5

Rename preview images. remove 01 number in end of pngs fix missing dependency in dataTypesDependencies woorkbook metadata Fix provider name of workbook metadata

Add tests custom tables

09e1ae7

nadavgr and others added 2 commits January 26, 2026 11:05

add tests custom functions

07c84b1

Merge branch 'Azure:master' into filewall

b73e0b3

Merge branch 'master' of github.com:odixer/Azure-Sentinel into filewall

c26170d

# Conflicts: # Workbooks/WorkbooksMetadata.json

nadavgr added 2 commits February 25, 2026 16:01

update api versions

a4a0767

Merge branch 'master' into filewall

c5166b8

nadavgr added 2 commits March 10, 2026 13:18

Merge branch 'master' into filewall

a09544a

# Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

Merge branch 'master' into filewall

2709691

nadavgr added 3 commits May 11, 2026 14:13

Merge branch 'master' into filewall

a74b7b8

# Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

remove unused image. already in Logos

7cf3643

update publisher id

a7ecd19

change in env. not sure needed

323c87b

v-maheshbh requested a review from Copilot May 28, 2026 10:47

Copilot AI reviewed May 28, 2026

View reviewed changes

nadavgr added 2 commits May 28, 2026 15:45

review fix

aee3b5a

Merge branch 'master' into filewall

4f77e7a

nadavgr added 3 commits May 30, 2026 14:39

fix max 3 entity mapping

942d85b

Merge branch 'master' into filewall

5e5b6f8

rebuild

34e9a15

v-maheshbh approved these changes Jun 4, 2026

View reviewed changes

Comment thread ...for Microsoft 365/Data Connectors/FilewallM365Logs_CCP/FilewallM365_ConnectorDefinition.json Outdated

Comment thread Solutions/Filewall for Microsoft 365/SolutionMetadata.json

v-atulyadav approved these changes Jun 4, 2026

View reviewed changes

v-dvedak approved these changes Jun 4, 2026

View reviewed changes

v-dvedak merged commit 0db4cc9 into Azure:master Jun 4, 2026
36 of 37 checks passed

Conversation

nadavgru commented Jan 15, 2026

Uh oh!

nadavgru commented Jan 15, 2026

Uh oh!

nadavgru commented Jan 15, 2026

Uh oh!

v-maheshbh commented Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nadavgru commented Jan 19, 2026

Uh oh!

v-maheshbh commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

v-maheshbh commented Jan 27, 2026

Uh oh!

v-maheshbh commented Mar 6, 2026

Uh oh!

v-maheshbh commented Mar 27, 2026

Uh oh!

v-maheshbh commented Apr 6, 2026

Uh oh!

nadavgru commented Apr 6, 2026 via email

Uh oh!

v-maheshbh commented Apr 16, 2026

Uh oh!

v-maheshbh commented May 20, 2026

Uh oh!

nadavgru commented May 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

v-maheshbh commented May 28, 2026

Uh oh!

nadavgr commented May 28, 2026

Uh oh!

v-maheshbh commented May 29, 2026

Uh oh!

nadavgru commented May 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

v-maheshbh commented Jan 19, 2026 •

edited

Loading

v-maheshbh commented Jan 23, 2026 •

edited

Loading